Code injection

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...